As the world moves to a proliferation of internets, intranets and extranets, user authentication has become increasingly important. The most common authentication mechanism is a password. Static, user-selected passwords are inherently limited as protection devices, however, because of the relatively small number of bits of information they contain. In addition, users tend to select easy-to-guess passwords, thereby compromising the authentication process.
One-time passwords overcome many of these limitations. In a one-time password system the password changes every time it is used. Instead of a static phrase, the system assigns a static mathematical function. The result is a “dynamic password.”
In one dynamic password system, the system provides an argument for the function and the user computes and returns the function value. This approach is termed “challenge/response.” In challenge/response, a password generating device such as a token card receives a value from the system and computes a one-time password by plugging the value into a complex mathematical function. The one-time password is then transmitted to the system in order to authenticate the user. Challenge/response devices can be implemented in either hardware or software and are very effective for user authentication.
Smart cards have also been proposed for user authentication. For instance, smart cards can be used to carry a user's identity securely and conveniently. In a typical smart card authentication system users approach a terminal and insert their smart cards into a smart card reader. The system queries the smart card through the smart card reader and performs a user authentication based, for instance, on a one-time password.
Public key cryptography promises an even more effective means of authenticating a user. In public key cryptography, cryptographic keys come in public key/private key pairs. The public key is used to encrypt while the private key is used to decrypt.
The public key/private key pair is assigned to a user. The public key is used by others to encrypt data. The encrypted data can only be read by the owner of the corresponding private key.
Authentication of a user through public key cryptography is straightforward. Under the Public Key Infrastructure (PKI), each user possesses a unique distinguished name. For example, a user, Alice, generates a unique distinguished name and a public/private key pair. The distinguished name is associated with Alice's public key via an X509 Certificate signed by the trusted Certificate Authority (CA). In such a system, Alice keeps her private key secret and publishes her certificate with the CA.
Alice's public key is used to encrypt data so that only Alice, with her private key, can decrypt it. In a PKI-based system, a user wishing to communicate securely with Alice retrieves her certificate from the CA, obtains the associated public key and encrypts the communications with Alice's public key.
In addition, Alice's private key can be used to produce a digital signature The digital signature verifies that Alice signed the data and maintains the integrity of the data being transferred. To verify the signature, the user retrieves Alice's certificate from the CA and processes the signature with the associated public key.
The CA, therefore, is an integral part of the Public Key Infrastructure.
To-date there has been no cohesive approach to public key authentication. Digital certificates can be used to standardize how identities, rights and privileges are assigned to users but, although server-side digital certificates are becoming common, there are few applications which supply certificate-based credentials to individual users. Directory services may provide standard, enterprise-wide storage for information about users and systems, but to-date, directory services are not widely deployed. Smart cards may become a ubiquitous medium for safeguarding and transporting a user's credentials, but to-date, deployment costs and changing standards have slowed the deployment of smart cards for user authentication.
What is needed is a system and method for user authentication which uses a smart card to supply certificate-based credentials to individual users. In addition, what is needed is a certificate-based authentication system which operates in conjunction with methods of user authentication such as token-based authentication, biometrics and simple passwords.